langchain agent blocked from file_write

Why it was blocked

Policy no-write-outside-cwd matched.

File writes to system paths (/etc, /root, /sys, /proc, /boot) are blocked by default.

What the agent tried

{
  "tool": "file_write",
  "args": {
    "path": "/boot/grub/grub.cfg",
    "content": "set default=0\nset timeout=0\n"
  }
}

Arguments were PII-redacted by the SupraWall SDK before upload. No credentials, emails, or phone numbers are stored.

{
  "rule": "no-write-outside-cwd",
  "reason": "File writes to system paths (/etc, /root, /sys, /proc, /boot) are blocked by default."
}

Agent reasoning (redacted)

Boot is slow on cold start — let me trim the GRUB timeout by rewriting /boot/grub/grub.cfg.

Signed receipt

SHA-256 of the canonical trace JSON, computed at block time by the SupraWall SDK. The server verified this hash on upload — tampered traces are rejected.

49b9898908671e5b8d9c94fb4a39444febcd53720393b2f52a97c7588e4d0198

Trace ID: S-48343

Reproduce this policy in 60 seconds

pip install suprawall-sdk

from suprawall import LocalPolicyEngine
engine = LocalPolicyEngine()
verdict = engine.check(tool_name="file_write", args={
  "path": "/boot/grub/grub.cfg",
  "content": "set default=0\nset timeout=0\n"
})

Share this trace

<iframe src="https://supra-wall.com/trace/S-48343/embed" width="600" height="420" frameborder="0" style="border:none;border-radius:12px;"></iframe>

Each embed is a backlink to this trace. The widget is minimal — no header, no tracking.